Introduction
ThreadFix supports Defect Trackers, this involves two primary functions. The first is to bundle and export ThreadFix vulnerabilities into the tracker's defect format. The second is to get the current status of the defect from the tracker and update the ThreadFix vulnerabilities.
Supported Defect Trackers
As of ThreadFix version 3.4, integration support has been discontinued for Bugzilla (ver 4.x & 5.x), IBM ClearQuest, and VersionOne.
ThreadFix currently supports these Defect Trackers:
HP Quality Center (acquired by Micro Focus)
https://www.microfocus.com/en-us/products/alm-quality-center/overview
Hewlett-Packard's Quality Center is quality management software featuring defect and requirements tracking. It is available as a free, open-source Community Edition or as a paid Enterprise version. The Enterprise version has an expanded feature set and technical support. Installation of HPQC Enterprise can be on premise, or is available in a SaaS implementation. More information regarding HP Quality Center is available on the HP website.
JIRA
Atlassian's JIRA is a project management and issue tracking application, geared toward agile development. Users can install JIRA on their own server, or use a hosted, SaaS solution. More information is available on the Atlassian website. OAuth is supported in ThreadFix for JIRA.
To be able to submit defects, the JIRA user account must have these permissions: Browse Projects, Create Issues, Assign Issues and, if the project does not allow non-assigned issues, at least one user must have the Assignable User permission.
ThreadFix leverages JIRA’s Status and Status Category* fields to determine if a defect is Open (red) or Closed (green). Note: If the Status Category is available, ThreadFix prioritizes it over Status.
JIRA has three status categories: To Do, In Progress, and Done. If a defect has a Status Category of “Done”, it is considered Closed in ThreadFix. The status of “Resolved” falls under the “Done” category.
JIRA allows users to create and map various statuses to different categories but does not allow users to create new categories.
Azure DevOps (formerly Microsoft Visual Studio Team Foundation Server / VSTS)
Azure DevOps is a version control and project management platform aimed at developing Windows applications. More information can be found on Azure DevOps Services | Microsoft Azure. This application shares the same API as Visual Studio Team Services.
Note 3.X supports pulling a maximum of 1000 projects for an organization.
Rally (CA Agile Central)
Rally (now CA Agile Central) is an enterprise-class platform that's purpose-built for scaling agile development practices. It provides a hub for teams to collaboratively plan, prioritize and track work on a synchronized cadence. You can read more about its features and capabilities on the CA Technologies website.